Within any organization, whether it is a large financial institution or other national or international business entity, a non-business entity, a governmental entity, or some other entity, it is important to monitor and control which members of the organization have access to which of the organization's information and resources as well as the types of access granted to each member. For example, in a banking institution certain people should have access to customer account information while others should not. Of these people with access to customer account information, some should have both read and write access while others should only have read access.
Other examples of access to resources within an organization that may need to be closely monitored include such things as access to customer and employee confidential information, access to different software applications and profiles, access to areas of a building or other physical or virtual structures, and the like. The different access rights granted to members of an organization are generally referred to herein as “entitlements.”
Traditional techniques for monitoring and controlling the distribution of entitlements generally involve persons within the organization periodically reviewing the entitlements assigned to each individual member of the organization. Such traditional techniques pose significant problems. Perhaps the most significant problem is the fact that it takes a significant amount of an organization's resources to individually monitor and manage the entitlements of each member of the organization.
Specifically, large organizations can have tens or even hundreds of thousands of employees and millions of potential entitlements that need to be managed. Furthermore, each member is typically assigned numerous entitlements and, as such, there may be many millions of different entitlement combinations existing within the organization at any one time. Managing so many combinations of entitlements can be a monumental, if not impossible task, using traditional entitlement management techniques. The distribution of entitlements within an organization, however, is so important for both operation and compliance reasons that it must be monitored and controlled.
Additional confusion results when members transition to new roles within the organization. These transitioning members often require new entitlements to be able to operate effectively in their new roles, but they also may need their old entitlements for some period of time after their transition. If not properly managed, a person that transitions within the organization several times may accumulate a long line of legacy entitlements from previous roles in the organization. Such legacy entitlements may not be useful to the person any longer and can, in fact, create security risks or compliance issues if not properly monitored. For example, certain internal or external rules and regulations may require that one person not have access to entitlement “A” and entitlement “B.” If a person who required access to entitlement A transitions within the organization several times and ends up in a role where he requires access to entitlement B but still has a access to entitlement A from his earlier role, the rules and regulations would be violated.
Confusion regarding the dissemination of entitlements may also arise any time a new system or technology is implemented since the entitlement administrators may not be aware of who needs access to the new system or technology and who can have the old system or technology entitlements removed. Other costs may also arise out of poor management of entitlements. For example, where the entitlements include access to software, improper monitoring and control of entitlements can result in greater licensing payments being paid to the software provider than is necessary. More specifically, the organization may pay a periodic payment to the software provider for each member of the organization that as access to the software. If members of the organization have access to the software but do not use or need the software any longer due to a change in job function or a change in systems, then the organization can save money in licensing payments if it can recognize the existence of such legacy access to the software.
A good entitlement management system should also be able to anticipate which entitlements a new employee or person transitioning into a new role will need to perform their job effectively. Traditional systems cannot anticipate needs effectively since the people managing the entitlements usually do not have intimate knowledge regarding the new employee's job function and which entitlements are needed for that job function. Even the new employee or the person transitioning into the new role will usually not know which entitlements they need because they may not know which entitlements are available. For all these reasons, organizations desire more efficient and accurate systems for managing the distribution of entitlements.